test: qualify performance gates in CI

[douglasmonsky]

Summary

• separate deterministic scale invariants from calibrated wall-clock qualification
• bound the fixed performance suite with a portable repository-owned five-minute runner
• fail closed on the exact versioned 17-metric budget contract and distinguish real timeouts from exit 137/OOM
• add weekly/manual five-run hosted qualification plus strict known-host mode

Validation

• just v (564 core/release tests, 13 bounded performance tests, frontend/static/release checks)
• five independent github_hosted_qualified runs and aggregate: pass, 17/17 metrics, no breaches
• Ruff, MyPy, Pyright, actionlint, scope, bootstrap readiness, GitNexus compare

Review

• one final read-only reviewer: 4 findings, 4 accepted/resolved; token attribution pending